Live data from Hacker News

DNS over HTTPS

github.com

121–130 of 195 posts

Re: DNS over HTTPS

#121
I've been pushing all my DNS traffic over a VPN, transparently, for the whole house, for years now (by setting the VPN remote IP as the upstream resolver on my router).

It seems the only advantage of DNS-over-HTTPS is that it does DNS over TLS on port 443, which is harder for militant netadmins to block.

It's definitely a solution to a niche problem, but if we really want to encrypt DNS at scale then we could do it easily enough by introducing DNScurve to the SOHO market.

Re: DNS over HTTPS

#122
I'm wondering if libcurl supporting custom DNS resolvers could make it easier to explore alternative DNS systems like namecoin.

Re: DNS over HTTPS

#123

> for privacy, performance and security. I understand the privacy and security aspects. But I am wondering - how can DNS over HTTPS be more performant in the case of curl commands? A browser could probably persist the connection to the resolver and issue several requests together, but with a single curl command surely there's the overhead of initiating the first DNS resolve, the HTTPS connection, the second DNS resol…

It has zero performance advantages

If you had to go the TLS route and wanted better perf, then it'd make more sense to build a new, dead simple, framing protocol that actually specified working pipelining and eliminated HOL blocking by allowing out-of-order responses.

They're just using HTTP because HTTP(S) defaults to port 443 and it'll go through more firewalls, and I guess their thinking here is to (just add more complexity) and move to HTTP/2

Re: DNS over HTTPS

#125
post #89

Earlier quoted context omitted.

What's cromulent mean? I looked it up at dictionary.com and couldn't find anything. Or are you making up more words to point out the irony? :)

I wonder if you can use "cromulent" to guess the age of a person. Older people would not have watched the Simpsons in the early 90s. Younger people very likely missed this obscure episode. I would guess an age of the user to be 30-35.

The episode was first aired in Feb ‘96, at which point I was 20, and in college. At this point the show was still quite popular with my friend group. I am currently 42. You might need to increase your upper bound on the age range.

Re: DNS over HTTPS

#126
post #40

Earlier quoted context omitted.

efficiency = performance / resources Efficient has connotations of economy, of optimal use of resources but with a hint of parsimony - another way to get efficiency is to reduce the denominator. Performant emphasises the numerator much more.

*increase the denominator. nitpick aside, agreed

The denominator is "resources," which here means "resource cost." Increasing resource cost reduces efficiency. You want to either increase the numerator ("performance") or decrease the denominator ("resources").

Re: DNS over HTTPS

#128
post #40

Earlier quoted context omitted.

Can anyone give examples of cases where “performant” would be better than “efficient”? To my mind, the difference is that “performant” delivers results quickly, whereas “efficient” uses little energy. A performant solution might be efficient, but not necessarily, and vice versa. Does anyone else share this understanding or am I living in a linguistic bubble? Not sure about Swedish (Daniel is Swedish), but in Finnish,…

efficiency = performance / resources Efficient has connotations of economy, of optimal use of resources but with a hint of parsimony - another way to get efficiency is to reduce the denominator. Performant emphasises the numerator much more.

Yep. A top fuel dragster goes from 0-60 mph (~0-100 kmh) in about 0.2 seconds, but it will use about 20 gallons (~75 liters) of fuel going 1,000 ft (~300 m). Very high performance. Very low efficiency.

Re: DNS over HTTPS

#129
post #52
post #8

Earlier quoted context omitted.

You can remember a small set of resolved hosts for this purpose, not unlike remembering DNS servers or CAs to trust. A quick search online also says it's possible to issue a cert to a public IP address, so you can also do HTTPS to a numbered IP instead of a host name.

I haven't heard of any respectable CAs that would issue certs for IP addresses...

They're rare but they do exist. The CA needs to ensure you really have long term control over the address.

Most people would never need one, but a few people have a real use for them.

Re: DNS over HTTPS

#130
post #104

Earlier quoted context omitted.

In USA and UK at least unauthorised access or use of a computer is criminalised. On some situations you can argue for assumed consent, the law doesn't operate on "if I can do it then it's authorised". Unless you can show you have permission then it's not authorised, ergo not legal. AIUI; not legal advice.

But the premise was to circumvent crap such as captive portals. Doing that on your own computer (mostly in a public wlan), I don't see any reason against it.

You're still circumventing security measures to use somebody else's hardware in a way they clearly don't want you to. That's illegal in most cases.
Post reply on HN